rica J. Snchez Vzquez The .

pr controversy Introduction In 2010, it was reported in Puerto Rican media that that the University of Puerto Rico (UPR) was suing Gauss Research Laboratory, Inc. (GRL, Inc.) for illegal appropriation of the country code top level domain (ccTLD), the .pr. The university is asking the court to make GRL, Inc. hand over documents, lists of clients, and other information about the registry's operations. The lawsuit specifically contends that the ccTLD's administrative contact, Oscar Moreno de Ayala, made false representations to the university with the intention of gradually and illegally taking away administration of the .pr domain, without the knowledge of university administrators (Universidad de Puerto Rico vs. Oscar Moreno de Ayala, 2011). Whatever the outcome of the lawsuit may be, it is clear that there must have been some structural and operational flaws that led to this controversy. This paper seeks to analyze and explain what those flaws were at three levels of governance: the organization that oversees the Domain Name System, the Internet Corporation for Assigned Names and Numbers (ICANN); the Puerto Rican government; and the university. At each of these levels, there were actions or lack thereof that are at the root of the .pr's problem. This paper will begin with a brief explanation of how the Domain Name System is managed, focusing on ccTLDs. It will then go into the .pr's history, its functioning structure, and outline the events that unfolded over the past few years, up to the lawsuit. After this, it will answer the main research question: which factors made this legal dispute possible and what could have prevented it? Then, it will provide policy recommendations that the university could implement if it wins the case.. Background and functioning The domain name system (DNS) is the set of databases distributed around the world that links domain names to the numeric addresses that computers can read (Kruger, 2011). It's one of the key

components of Internet infrastructure, and requires coordination to function properly. ICANN, which formed in 1998, is the entity that is currently in charge of doing this. It makes sure that the unique identifiers that permit Internet users to visit websites and enjoy the Web stay, precisely, unique. The identifiers that we put into our browsers, the domain names, are organized in levels. The top level domain (TLDs) includes generic TLDs (.com, .net) and country code TLDs. When the Internet was still taking its first steps, there was no formal DNS coordinator as there is now. The number of websites was not as large, and the DNS was coordinated by Jon Postel. Later on, an official name came up, the Internet Assigned Numbers Authority (IANA) (Yu, 2004). Currently, IANA is a department of ICANN, responsible for allocating and maintaining unique codes and numbering systems used in the technical standards of the Internet (IANA, 2011). The first ccTLD, .us, was created and delegated in March, 1985, and by the mid 1990s, almost every country-code, determined by ISO3661-1, was delegated. Between 1985 and 1993, IANA delegated ccTLDs on a first-come, first-served basis (Yu, 2004, p. 390). Usually, they were delegated to universities' computer science departments or educational and research networking organizations, instead of governments (Yu, 2004) In 1994, Jon Postel published the document Request For Comment 1591 on the Internet Engineering Task Force website, providing more detailed guidelines for IANA's task of overseeing the DNS structure. It established that each country code domain would be organized by an administrator for that country, and they each would decide how to go about managing it. Despite this freedom, registries make a commitment to carry out ethical and technical responsibilities. Managers are considered trustees of TLDs not just for each nation, but for the global Internet community. Moreover, Postel wrote: Concerns about 'rights' and 'ownership' of domains are inappropriate. It is appropriate to be concerned about 'responsibilities' and 'service' to the community (RFC 1591).

Story of the .pr ccTLD1 In 1988, the University of Puerto Rico (UPR) applied to have the .pr ccTLD inscribed under Gauss Research Laboratory, an investigative body at the Natural Sciences Faculty. The request was approved, officially delegating the domain to the Laboratory, which was directed by Oscar Moreno de Ayala. The former professor was also the administrative contact at IANA and the person in charge of the domain. Up to 2006, the registry operated under university mandate, although coordination was delegated to Moreno de Ayala. A 2003 article on Vida Digital explained that the domain's structure was more academic rather than functional and commercial (Minet, 2003). Moreno de Ayala himself explained on the same article that the university did not see it as a business. Their vision of the domain was as a way to obtain funds for Internet infrastructure. The article states that since its inception up to that moment, it had registered 2,000 domain names, making $200,000 annually. According to the lawsuit, from 1997 to 2004, revenues amounted to $1,829,401.00. The entity's structure was the following: three technical support workers, one committee of academic specialists, and another committee that dictated policies (Minet, 2003). The central government was not involved in overseeing the structure, despite the project being publicly funded. The project's funds were originally administered by the Center for Science and Engineering Resources at the university. However, in 2006 Moreno de Ayala requested that a separate account be created in order to fulfill new objectives for the program. The account was created with him in charge, and $400,750.79 were transferred to it. One month later, on September 5, 2006, without the approval of the university's administration, GRL acquired a T1 telecommunication circuit to connect independently to the Internet and provide registration services autonomously. Then, on September 15th, Moreno de Ayala requested that only GRL be exclusively allowed to announce the IP addresses that were assigned. The administration
1 The information provided in this section comes from the cited lawsuit, unless otherwise noted

approved and the request was made effective starting in October. This further diminished the UPR's administrative bodies' role in management of the .pr. The next step was taken in November. Moreno de Ayala created the non profit corporation called Gauss Research Laboratory, Inc. It should be noted that the corporation's address is the same as Moreno de Ayala's personal address, which appears on the lawsuit. On the same date, another for profit entity was created under the same name and address. The non profit was later cancelled, but the for profit corporation still appears as active on the Puerto Rican State Department's archives. The organization's purpose, according to the registry, is to execute all activities related to the administration and management of domain registry, as defined by ICANN (Puerto Rico State Department, 2011). The lawsuit specifies that the corporation was created a short time after the UPR's Legal Affairs Office requested information about contracts, funds, and operation of the domain. The last step for the transfer was to change the contact information in IANA. A 2005 archived version of the Root-Zone Whois information --which gives delegation details for TLDs-- for .pr reveals that the sponsoring organization was the University of Puerto Rico, specifically the Gauss Laboratory at the Facundo Bueso Building in the main campus. The administrative contact was Oscar Moreno, with the same address at the UPR campus. The administrative and technical contact information, which includes email, phone number and fax number, is also based at the university. However, looking at the file's most recent version, the university's name has been completely eliminated (IANA, 2011). The sponsoring organization is now GRL, Inc., under Moreno de Ayala's personal address. He has not changed as the administrative contact, and judging from the nameless technical contact's address, he also fulfills that function. The server names have also changed. For example, in the 2005 version (IANA, 2005), one of them was called descartes.uprr.pr. It is now called descartes.nic.pr. Even after this process, however, GRL, Inc. still used university funds for its operations. As the lawsuit states, Moreno de Ayala requested money from the Science and Engineering Resource center to pay for salaries, materials and trips related to development of the .pr. The university also payed for the

ICANN conference in 2007 in Puerto Rico, but wasn't presented as a sponsor. There is a great deal of ambiguity as to the current operations of GRL, Inc. (Serrano, 2011) The university requested information about the .pr management and usage of funds, but Moreno de Ayala never responded. Subsequently, he retired as professor and took with him all information and documentation regarding the domain. Since around 2008, he has been operating it without any formal relationship with the university. It wasn't until May 2011 that the UPR took the step of suing GRL, Inc. The lawsuit is requesting that the domain, its administration and its funds be transferred back to the university. At the moment, the lawsuit seems to be open, though no further information has been published regarding hearings. The only information that Ivelisse Rubio, a professor at the Computer Science Department gave was that GRL, Inc. is still registering domains and that it's hard to say what will happen with the domain if the university wins (personal communication, December 4, 2011). Structural and procedural failures In analyzing what happened, it's useful to start with organization that's on top of the entire system. ICANN's flawed overseeing procedures are evidenced by an email exchange between Eduardo Daz, then president of the Internet Society of Puerto Rico, and David Conrad, a representative of ICANN. In July 2007, Daz wrote to Conrad that ISOC-PR had noticed that the ccTLD had been redelegated but could not find any public documents related to this re-delegation. Conrad's response was that it was a structural reorganization of the domain operator. Since the underlying organization performing registry services for .PR did not change (it was Gauss Laboratories before and after the change), this is not considered a full redelegation, and therefore does not result in a public report with board approval (Conrad, 2007). The proper redelegation procedure would have required an application that proved that the previous delegate approved redelegation, and that the local Internet community was also supportive. IANA, which is the initial body in charge of reviewing applications, also asks applicants to explain the

purpose of the request, and prove that they have the capabilities of fulfilling responsibilities. After IANA approves or rejects the application, it must also be approved by the ICANN Board of Directors, and then by the United States Department of Commerce. The IANA website specifies that in cases where change entails only a change of administrative responsibility to a new organization that is essentially the same as the previous organization, less information is requested, and it need not get approved by the ICANN Board. In the case of the .pr, we see that the administrative structure remained essentially the same. Since there had not been much involvement from the upper administrators at the university, and names remained the same, it did not look like a redelegation. But ultimately it was. Prior to the change, contact addresses always said Gauss Research Laboratory, but that was the physical place where the domain was managed inside campus. Moreno de Ayala used this for the name of the sponsoring organization, which changed from University of Puerto Rico to GRL, Inc. Edward Conlon (2011) says that the problem highlights what a working group report from February 2011 addressed. This report from the Chair of the Country Code Names Supporting Organization (2011) states that there has been a lack of consistency between Policy Statements and actual processes as reflected in IANA's documentation. Thus, they specifically recommend that the ccNSO develop a Framework of Interpretation for the re-delegation of ccTLDs. The idea is to have a clear guide to interpret current policies, guidelines and procedures, and get consistent results.They add that results of this Framework should be monitored and evaluated by the ccNSO council for a predetermined period of time. At the university level, the main problem was that the UPR did not have a well structured body in charge of making policy for the .pr. The domain was handled by Moreno de Ayala without much oversight or involvement from central administration. This is fine when it comes to the most technical matters, but when it comes to regulation there should be a multistakeholder decision making structure. Milton Mueller actually questions whether the technical coordinating body should be the one making

decisions where identifiers are publicly visible and meaningful (Mueller, 2002). Who gets to register a domain under .pr? For how much? Where do revenues go? These are all decisions that need to be put through a legitimate body and process if the ccTLD is, as Postel had stated, for the service of the community. Transparency has also been a huge problem. Up to 2008, when they requested information about its administration, there seems to have been a lack of interest in how it was operating. If this was the case for the administration, the rest of the university community had even less information. Most of it was unaware of the existence of the .pr domain under university management. The UPR's website currently makes no mention of it, and very few articles on the main local newspapers reported on operations. Another element that adds to this lack of awareness is that GRL, Inc.'s and the Computer Science Department's websites are both in English. 80% residents in Puerto Rico do not feel they speak English well (US Census Bureau, 2005), which is even more worrisome in such technical matters as Internet infrastructure and policy. This lack of publicity also makes accountability less likely. Students and employees at the university could not have demanded better practices or enforcement of better standards if they did not even know about this resource. This situation also needs to be put in a wider context. Since 2008, the financial and administrative situation of the university has been precarious. The administrative bodies lack legitimacy, and are highly politicized and unstable. Students, supported by staff and professors, have gone on strike and paralyzed most university functions in two separate occasions because of disagreement with various decisions.2 This instability makes management, transparency and accountability more difficult. The pressing question, then, would be: should the central government have been involved? In 2008, it actually attempted to. Senate Project 2445 proposed the creation of an

2 The Puerto Rico episode of Al Jazeera's Fault Lines provides good background on the subject: http://www.youtube.com/watch?v=P4d8XRHoKIc&feature=relmfu

Administrative Committee for the .pr Domain. The Committee's task would be to execute any procedures regarding administration of the domain, regulate its operation and direct its revenues to the benefit of the University of Puerto Rico. At that point, however, the domain had already been transferred to Moreno de Ayala's private corporation, a fact that is acknowledged by the project itself. A similar project came up again in May 2011, the same month that the lawsuit was filed. It was also supposed to create a regulating and administrative body for the .pr. It frames the issue as the ccTLD being part of the national patrimony. They take a business angle as well, by stating that companies might use a ccTLD as part of its communication strategy. The Committee would have had a multistakeholder membership, representing public and private sectors. It would promote commercialization for the domain, under very specific rubrics. One requirement that was stressed on the legislative piece was that they should public statistics about the development of the domain. Both projects were attempts to increase oversight of operations, but they came too late. The government had also ignored the ccTLD until 2008, so there was also a transparency and accountability problem at that level. Milton Mueller has been very critical regarding government involvement in the DNS. He talks about how in the question of domain names, governments have been able to guide policy in their favor, specifically regarding how their names are used in cyberspace (Mueller, 2011). He notes that governments and international organizations are eagerly stepping in to the policy and legitimacy vacuum created by ICANN management's resistance of public accountability. Conclusion The case of the Puerto Rican ccTLD is pretty clear cut. Whatever Moreno de Ayala's intentions might have been, there was a process of deceit wherein the institution lost ownership of the domain. If the university wins the case, which is very likely given the evidence, they should start restructuring the domain's operations. This process should be completely transparent, starting with the publication of all pertinent documents handed to them by Moreno de Ayala.

After the university community is informed on past years' operations, the administration should start a consulting process to gather opinions on what type of structures to apply. If necessary, it could include public gatherings to propose and analyze options. It should also include representation from the government, the Internet community, and experts on the subject matter. There are many options that they might want to consider. The 2003 ccTLD Governance Project showed that there were five distinct forms of managing ccTLDs (Geist). One is for a government agency or department to be in charge. This is the case of Spain, which has a very comprehensive website and structure. The agency sets the official policies to be followed and then lets private companies do the actual registrations. Another model is the private, for-profit enterprise. This is what Tuvalu has been doing with the .TV Corporation. Because their ccTLD coincides with the abbreviation of television, they have been able capitalize on it and bring in revenues for public spending. This model would work for Puerto Rico because .pr can be used as public relations, thus bringing in revenue outside local users. Another good choice would be to stick with the academic model. So far it has worked for Chile, which is regarded as one of the best structured ccTLD organizations in Latin America. All of these are viable, but each should be made in a way that transparency and accountability are not only possible but mandatory.

References: Universidad de Puerto Rico v. Oscar Moreno de Ayala; Gauss Research Laboratory, Inc.; Gauss Research Foundation, Inc. (Tribunal de Primera Instancia, Sala Superior de San Juan. US Census Bureau. (2005). Encuesta sobre la Comunidad de Puerto Rico del 2005-2009 -- Estimados de 5 Aos. Retrieved from http://factfinder.census.gov/servlet/ADPTable? _bm=n&_lang=es&qr_name=ACS_2009_5YR_G00_DP5YR2PR&ds_name=ACS_2009_5YR_G00_ &geo_id=04000US72. ccNSO. (2011). Final Report of the Delegation, Re-delegation and Retirement Working Group of the

ccNSO. NIC CHile. from http://www.nic.cl/ Conlon, E. (2011). Dot-pr dispute highlights ccTLD confusion. Retrieved November 21, 2011, from http://www.managingip.com/Article/2868803/Dot-pr-dispute-highlights-ccTLD-confusion.html Conrad, D. (2007). Letter to Eduardo Daz - Re: Puerto Rico's ccTLD re-delegation. Retrieved from http://domainincite.com/docs/Exhibit8-LETTER.DavidConrad-0001.pdf. Gobierno de Espaa. red.es. from red.es Departamento de Estado, Puerto Rico. (2011). Bsqueda de Corporaciones. Retrieved from https://prcorpfiling.f1hst.com/CorporationSearch.aspx. Gauss Research Laboratory, Inc. https://www.nic.pr/ Geist, M. (2002). ccTLD Governance Project. Geist, M. (2004). Governments and country-code top level domains: a global survey. IANA. (2005). Root-Zone Whois Information .pr - Puerto Rico (Archived copy). IANA. (2011). Delegation Record for .PR. Retrieved November 21, 2011, from http://www.iana.org/domains/root/db/pr.html IANA. (2011). Understanding the ccTLD Delegation and Redelegation Procedure. from http://www.iana.org/domains/root/delegation-guide/ ICANN. (2007). ICANN Formalizes Relationships with ccTLD Managers for Puerto Rico and Fiji. Retrieved November 21, 2011, from http://www.icann.org/en/announcements/announcement-226jun07.htm ICANN. (2011, September 16, 2011). Delegation Record for .PR. Retrieved November 21, 2011, from http://www.iana.org/domains/root/db/pr.html

ICANN, ccNSO, DRDWG. (2011). Final Report of the Delegation, Re-delegation and Retirement Working Group of the ccNSO. Kruger, L. G. (2011). Internet Domain Names: Background and Policy Issues. Retrieved from

http://www.fas.org/sgp/crs/misc/97-868.pdf. Minet, C. (2003). Larga espera para el .pr. VidaDigital.com. Mueller, M. L. Governments and Country Names: ICANN's Transformation into an Intergovernmental Regime. Mueller, M. L. (2002). Ruling the Root: Internet Governance and the Taming of Cyberspace. Massachusetts: Massachusetts Institute of Technology. Mueller, M. L. (2011). Internet freedom means keeping ICANN independent of governments. Intermedia, 39(4), 4-7. African Domain Names (2011). University of Puerto Rico files lawsuit against Dr. Oscar Moreno de Ayala, the .pr thief. Retrieved November 21, 2011, from http://www.domainsafrica.com/2011/07/university- of-puerto-rico-files-lawsuit.html African Domain Names (2011). How to steal a ccTLD: Dr Oscar Moreno and the theft of .pr ccTLD. Retrieved November 21, 2001, from http://www.domainsafrica.com/2011/07/how-to-stealcctld- dr-oscar-moreno-and.html Postel, J. (1994). RFC 1591: Domain Name System Structure and Delegation. Rivera, J. O. (2011). Puerto Rico pierde el control del dominio .pr en la web. El Nuevo Da. Retrieved from http://www.elnuevodia.com/puertoricopierdeelcontroldeldominio.prenlaweb1015056.html Villanueva, S. (2011). P. del S. 2137. Retrieved from http://www.senadopr.us/Proyectos%20del %20Senado/ps2137-11.pdf. Yu, P. K. (2004). The Origins of ccTLD Policymaking. Cardozo Journal of International & Comparative Law, 12, 387-408. Zapata, I. G. (2009). Letter to ICANN Retrieved from http://domainincite.com/docs/Exhibit-3LETTER.JohnJeffrey.pdf.